Source type definition configuration using a graphical user interface

Abstract

A data intake and query system provides interfaces that enable users to configure source type definitions used by the system. A data intake and query system generally refers to a system for collecting and analyzing data including machine-generated data. Such a system may be configured to consume many different types of machine data generated by any number of different data sources including various servers, network devices, applications, etc. At a high level, a source type definition comprises one or more properties that define how various components of a data intake and query system collect, index, store, search and otherwise interact with particular types of data consumed by the system. The interfaces provided by the system generally comprise one or more interface components for configuring various attributes of a source type definition.

The invention claimed is: 
     
       1. A method, comprising:
 causing a display to display a graphical user interface, wherein the graphical user interface includes:
 an attribute of data of a particular source type, wherein data of the particular source type is generated by one or more computing devices in an information technology environment, and 
 a user editable field for entering a value associated with the attribute; 
 
 receiving, via the graphical user interface, user input corresponding to the value for the attribute; 
 storing, in a configuration file, the value in association with the attribute as an attribute-value pair of a plurality of attribute-value pairs that correspond to data of the particular source type; and 
 causing the configuration file to be stored on at least one computing device of a data intake and query system, wherein the at least one computing device uses the attribute-value pair to generate at least one event from data of the particular source type. 
 
     
     
       2. The method of  claim 1 , further comprising:
 subsequent to causing the configuration file to be stored on the at least one computing device, receiving a query for data of the particular source type; and 
 processing, the query based at least in part on the attribute-value pair stored in the configuration file. 
 
     
     
       3. The method of  claim 1 , wherein the configuration file further includes at least one attribute related to determining a timestamp for events generated from data of the particular source type. 
     
     
       4. The method of  claim 1 , wherein the configuration file further includes at least one attribute related to extracting at least one field from events generated from data of the particular source type. 
     
     
       5. The method of  claim 1 , wherein the value stored in association with the attribute comprises a regular expression. 
     
     
       6. The method of  claim 1 , wherein causing the configuration file to be stored on at least one computing devices comprises communicating the configuration file to the at least one computing device. 
     
     
       7. The method of  claim 1 , wherein the graphical user interface is a first graphical user interface, the method further comprising:
 causing display of a second graphical user interface displaying a list of source type definitions; and 
 receiving an indication of a selection of a particular source type definition from the list of source type definitions, 
 wherein the first graphical user interface is caused to be displayed in response to receiving an indication of the selection of the particular source type definition. 
 
     
     
       8. The method of  claim 1 , wherein the graphical user interface is a first graphical user interface, the method further comprising:
 causing display of a second graphical user interface displaying a list of source type definitions, 
 wherein the second graphical user interface includes one or more interface components to create a new source type definition or to delete at least one source type definition from the list of source type definitions. 
 
     
     
       9. The method of  claim 1 , further comprising:
 receiving, by the at least one computing device, particular data of the particular source type; and 
 based at least in part on the value stored in the configuration file:
 generating, by the at least one computing device, a plurality of events from the particular data, and 
 determining, by the at least one computing device, a timestamp for each event of the plurality of events. 
 
 
     
     
       10. The method of  claim 1 , further comprising:
 obtaining a sample of data of the particular source type; 
 generating a plurality of sample events using the value in association with the attribute; and 
 causing display of the plurality of sample events. 
 
     
     
       11. The method of  claim 1 , further comprising:
 obtaining a sample of data of the particular source type; 
 generating a plurality of sample events using the value in association with the attribute; 
 causing display of the plurality of sample events; and 
 receiving, via the graphical user interface, an indication that the plurality of sample events are approved, wherein the causing the configuration file to be stored on the at least one computing device is based at least in part on the receiving the indication that the plurality of sample events are approved. 
 
     
     
       12. Non-transitory, computer-readable storage media storing computer-executable instructions that, when executed by one or more computing devices of a data intake and query system, cause the one or more computing devices to:
 cause a display to display a graphical user interface, wherein the graphical user interface includes:
 an attribute of data of a particular source type, wherein data of the particular source type is generated by one or more computing devices in an information technology environment, and 
 a user editable field for entering a value associated with the attribute; 
 
 receive, via the graphical user interface, user input corresponding to the value for the attribute; 
 store, in a configuration file, the value in association with the attribute as an attribute-value pair of a plurality of attribute-value pairs that correspond to data of the particular source type; and 
 cause the configuration file to be stored on at least one computing device of the data intake and query system, wherein the at least one computing device uses the attribute-value pair to generate at least one event from data of the particular source type. 
 
     
     
       13. The non-transitory, computer-readable storage media of  claim 12 , wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
 receive a query for data of the particular source type; and 
 process the query based at least in part on the attribute-value pair stored in the configuration file. 
 
     
     
       14. The non-transitory, computer-readable storage media of  claim 12 , wherein the graphical user interface is a first graphical user interface, and wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
 cause display of a second graphical user interface displaying a list of source type definitions; and 
 receive an indication of a selection of a particular source type definition from the list of source type definitions, 
 wherein the first graphical user interface is caused to be displayed in response to receipt of the indication of the selection of the particular source type definition. 
 
     
     
       15. The non-transitory, computer-readable storage media of  claim 12 , wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
 obtain a sample of data of the particular source type; 
 generate a plurality of sample events using the value in association with the attribute; and 
 cause display of the plurality of sample events. 
 
     
     
       16. The non-transitory, computer-readable storage media of  claim 12 , wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
 obtain a sample of data of the particular source type; 
 generate a plurality of sample events using the value in association with the attribute; 
 cause display of the plurality of sample events; and 
 receive, via the graphical user interface, an indication that the plurality of sample events are approved, wherein the configuration file is stored on the at least one computing device based at least in part on receipt of the indication that the plurality of sample events are approved. 
 
     
     
       17. A system, comprising:
 one or more computing devices configured to:
 cause a display to display a graphical user interface, wherein the graphical user interface includes:
 an attribute of data of a particular source type, wherein data of the particular source type is generated by one or more computing devices in an information technology environment, and 
 a user editable field for entering a value associated with the attribute; 
 
 receive, via the graphical user interface, user input corresponding to the value for the attribute; 
 store, in a configuration file, the value in association with the attribute as an attribute-value pair of a plurality of attribute-value pairs that correspond to data of the particular source type; and 
 cause the configuration file to be stored on at least one computing device of a data intake and query system, wherein the at least one computing device uses the attribute-value pair to generate at least one event from data of the particular source type. 
 
 
     
     
       18. The system of  claim 17 , wherein the one or more computing devices are further configured to:
 receive a query for data of the particular source type; and 
 process the query based at least in part on the attribute-value pair stored in the configuration file. 
 
     
     
       19. The system of  claim 17 , wherein the graphical user interface is a first graphical user interface, and wherein the one or more computing devices are further configured to:
 cause display of a second graphical user interface displaying a list of source type definitions; and 
 receive an indication of a selection of a particular source type definition from the list of source type definitions, 
 wherein the first graphical user interface is caused to be displayed in response to receipt of the indication of the selection of the particular source type definition. 
 
     
     
       20. The system of  claim 17 , wherein the one or more computing devices are further configured to:
 obtain a sample of data of the particular source type; 
 generate a plurality of sample events using the value in association with the attribute; and 
 cause display of the plurality of sample events. 
 
     
     
       21. The system of  claim 17 , wherein the one or more computing devices are further configured to:
 obtain a sample of data of the particular source type; 
 generate a plurality of sample events using the value in association with the attribute; 
 cause display of the plurality of sample events; and 
 receive, via the graphical user interface, an indication that the plurality of sample events are approved, wherein the configuration file is stored on the at least one computing device based at least in part on receipt of the indication that the plurality of sample events are approved. 
 
     
     
       22. The system of  claim 17 , wherein the at least one computing device is configured to:
 receive particular data of the particular source type; 
 generate, based at least in part on the value stored in the configuration file, a plurality of events from the particular data; and 
 determine a timestamp for each event of the plurality of events.